Introduction When Istio sidecar injection fails, new pods start without the Envoy proxy, meaning they are not part of the service mesh. This breaks mTLS, traffic management, and observability.

Symptoms - Pods starting without istio-proxy container - `kubectl get pods` shows 1/1 instead of 2/2 containers - Error: "no matching namespace injection policy" - Mutating webhook not triggering - Pods not appearing in Istio Kiali graph

Common Causes - Namespace not labeled for injection - Mutating webhook configuration deleted or disabled - Resource quota preventing sidecar resource allocation - Istio control plane not running - Injection template misconfigured

Step-by-Step Fix 1. **Check namespace injection label': ```bash kubectl get namespace <namespace> --show-labels # Should have: istio-injection=enabled kubectl label namespace <namespace> istio-injection=enabled --overwrite ```

  1. 1.**Verify mutating webhook':
  2. 2.```bash
  3. 3.kubectl get mutatingwebhookconfiguration istio-sidecar-injector
  4. 4.kubectl describe mutatingwebhookconfiguration istio-sidecar-injector
  5. 5.`
  6. 6.**Restart Istio control plane':
  7. 7.```bash
  8. 8.kubectl rollout restart deployment -n istio-system
  9. 9.`

Prevention - Verify sidecar injection in CI/CD before deploying - Monitor sidecar injection failure rate - Use Istio admission webhooks for validation - Document namespace labeling requirements - Test injection after Istio upgrades